Locked production behind my approval

The request

Make sure nothing on main can reach production until I sign off on the cutover.

web/vercel.json now disables Git deploys from main. Pull request branches still get previews, and production waits for an explicit go-ahead.

Preview & deploy. These are the same fleet playbooks every project uses. How the skills work